RISK  M  ANAGEM  ENT  TABLES 


ANNEXUREA 


RISK  IS  MEASURED  ACCORDING  TO  IMPACT  &  LIKELIHOOD 

The  following  is  an  example  of  a  rating  table  that  can  be  utilised  to  assess  the  potential  impact  of  risks 

IMPACT 


Score 

Grading  <& 
Descriptions 

Financial 

Impacts  of  a  financial  nature 
and  directly  affects  the 
municipality's  budget. 

Service  Delivery 

Impacts  on  the  ability  to 
provide  maximum  services  to  the 
stakeholders  with  existing 

resources. 

Reputation  &  Image 

Impact  is  of  a  reputational 
nature  stemming  from  bad 
publicity  of  the  municipality. 

Employee  Wellness 

Impact  stems  from 
employees  not  being  in 
the  best  mental,  emotional 
and  physical  state  to 
perform  duties. 

Legal/  Regularity/  Compliance 

Impact  is  on  the  ability  to 
comply  with  Acts,  laws, 
regulations  or  contracts  as 
well  as  with  municipal  policies 
and  procedures. 

5 

Critical 

Loss  of  assets,  major  adverse 
impact  on  annual  revenues. 
Financial  loss  of  31  -  100%  of 
budget. 

Threatens  ongoing  existence  of 
the  component/sub  directorate 
Total  disruption  of  service 
rendered  by  component/  sub 
directorate. 

51-100%  of  KPA's  not  achieved. 

Critical  breakdown  to  total  loss 
of  conf  idence  within 
stakeholders.  Sustained 
negative  publicity  or  damage  to 
reputation  from  a  national, 
perspective  -  long  term. 

Serious  permanent  injury  or 
death  of  more  than  20%  unit 
capacity. 

Temporary  to  complete 
destruction  of  the 
municipality  facility. 

Total  shut  down  of  the 
component  or  external 
intervention  required.  Serious 
failure  to  comply  with  legal 
requirements  that  results  in 
legal  action  against  municipality. 

4 

Major 

Loss  of  assets  with  some 
adverse  impact  on  annual 
revenues.  Financial  loss  of  16 
-  30%  of  budget. 

Permanent  loss  of  critical 
information,  substantial 
disruption  to  component 
extending  over  3  months. 

16-  50%  of  KPA's  not  achieved. 

Limited  breakdown  in  key 
relationship  with  stakeholders. 
Media  coverage  at  city/ 
provincial  level. 

Serious  permanent  injury  or 
death  of  one  or  two 
employees.  Entrenched 
morale  problems.  Inability  to 
recruit  employees  with 
necessary  skills. 

Failure  to  comply  with  laws  or 
contracts  conditions  that  may 
result  in  legal  action  against 
municipality. 

3 

Moderate 

Loss  of  assets  with  minor 
adverse  impact  on  annual 
revenues.  Financial  loss  of  8  - 
15  %  of  budget. 

Considerable  remedial  effort 
required  with  limited  disruption 
to  the  component  for  period  of  1 
week  or  less.  Less  than  15%  of 
KPA's  will  not  be  achieved 

Temporary  negative  impact  on 
reputation.  Once  off  media 
coverage  in  community 
circulation  only. 

Injury  but  able  to  return  to 
work  within  5  days.  Some 
morale  issues.  Medium 
employee  turnover.  Minor 
skill  mix  issues 

Non-compliance  with  policy  and 
procedures  results  in 
ineffective  procedures  that 
impact  on  the  KPA's. 

2 

Minor 

Loss  of  low  value  assets,  little 
to  no  adverse  impact  on  annual 
revenues.  Financial  loss  of  3 
-  7%  of  budget. 

No  impact  on  service  delivery. 
Easily  remedied,  some  impact  on 
external  stakeholders  and  minor 
KPA's  delayed. 

Customer  complaint  received. 

Lost  time  iro  temporary 
injury  (normal  sick  leave) 
Temporary  poor  morale 
within  the  component. 

Some  deviations  from 
prescripts.  Can  be  remedied 
internally. 

1 

Insignificant 

Insignificant  loss  of  assets  or 
insignificant  adverse  impact 
on  budget.  Financial  loss  of  0 
-  2%  of  budget. 

Small  delay,  internal 
inconvenience  only.  Can  be 
remedied  internally  immediately. 

Unlikely  to  cause  complaint  or 
warrant  coverage  in  media. 

Little  effect  on  public 
confidence. 

Minor  injury.  Individual  poor 
morale  within  the  compo¬ 
nent.  No  effect  on  staff 
moral. 

Slight  deviation  from 
prescripts.  Can  be  remedied 
internally  immediately. 

1 


RISK  M  ANAGEM  ENT  TABLES 


ANNEXUREA 


LIKELIHOOD 


The  following  is  an  example  of  a  rating  table  that  can  be  utilised  to  assess  the  likelihood  of  risks. 


Rating 

Assessment 

Definition 

1 

Rare 

The  risk  is  conceivable  but  is  only  likely  to  occur  in 
extreme  circumstances 

2 

Unlikely 

The  risk  occurs  infrequently  and  is  unlikely  to  occur  within 
the  next  5  years 

3 

Moderate 

There  is  an  above  average  chance  that  the  risk  will  occur 
at  least  once  in  the  next  3  years 

4 

Likely 

The  risk  could  easily  occur,  and  is  likely  to  occur  at  least 
once  within  the  next  12  months 

5 

Common 

The  risk  is  already  occurring,  or  is  likely  to  occur  more 
than  once  within  the  next  12  months 

2 
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ANNEXUREA 


INHERENT  RISK  EXPOSURE  (IMPACT  X  LIKELIHOOD) 

The  following  is  an  example  of  a  rating  table  that  can  be  utilised  to  categorise  the  various  levels  of  inherent  risk. 


Risk  rating 

Inherent  risk  magnitude 

Response 

15-25 

High 

Unacceptable  level  of  inherent  risk  -  High  level  of  control  intervention 
required  to  achieve  an  acceptable  level  of  residual  risk 

8  -  12 

Medium 

Acceptable  level  of  inherent  risk,  except  under  unique  circumstances  or 
conditions  -  Moderate  level  of  control  intervention  required  to  achieve  a 
more  acceptable  level  of  residual  risk 

4-6 

Low 

Mostly  acceptable  level  of  inherent  risk  -  Medium  level  of  control 
intervention  required 

1  -3 

Minimum 

Acceptable  level  of  inherent  risk  -  Low  level  of  control  intervention 
required,  if  any 

RESIDUAL  RISK  EXPOSURE  (INHERENT  RISK  X  CONTROL  EFFECTIVENESS) 


Risk  rating 

Residual  risk  magnitude 

Response 

15-25 

High 

Unacceptable  level  of  residual  risk  -  Implies  that  the  controls  are  either 
fundamentally  inadequate  (poor  design)  or  ineffective  (poor 
implementation).  Controls  require  substantial  redesign,  or  a  greater 
emphasis  on  proper  implementation. 

Acceptable  when  sufficient  controls  (cost  effective)  have  been 
implemented  which  are  regularly  monitored  (5x3=15) 

8  -  12 

Medium 

Acceptable  level  of  residual  risk,  within  risk  appetite  -  However,  can 
imply  that  the  controls  can  improve  (poor  design)  or  ineffective  (poor 
implementation  or  non-adherence).  Controls  require  some  redesign,  or  a 
more  emphasis  on  proper  implementation  and  adherence. 

4-6 

Low 

Mostly  acceptable  level  of  residual  risk  -  Requires  minimal  control 
improvements. 

1  -3 

Minimum 

Acceptable  level  of  residual  risk  -  Adequate  controls  implemented  and 
adhered  to. 

3 
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Risks  manifest  as  negative  impacts  on  goals  and  objectives  or  as  missed  opportunities  to  enhance  institutional  performance. 
Stakeholders  expect  the  Municipality  to  anticipate  and  manage  risks  in  order  to  eliminate  waste  and  inefficiency,  reduce  shocks  and 
crises  and  to  continuously  improve  capacity  for  delivering  on  their  institutionalised  mandates.  A  risk  is  therefore  an  event,  potential  or 
real,  that  could  have  an  impact  on  the  institution  achieving  its  objectives.  It  is  also  apparent  that  risk  is  measured  in  terms  of  the 
impact  that  it  would  have  on  the  achievement  of  objectives  and  the  likelihood  of  the  risk  materialising.  The  risk  rating  =  impact  score 
X  likelihood  score.  Inherent  risks  are  those  risks  that  exits  prior  to  any  controls  being  implemented  and  residual  risks  are  those  risks 
that  still  exist  after  controls  have  been  implemented. 


5  Critical 

5 

10 

4  Major 

4 
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12 
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2  3  4 

LIKELIHOOD 


0 

3 

5 


Inherent 

Risk  rating 

8-12 

Risk  magnitude 

Response 

High 

Unacceptable  level  of  inherent  risk  -  High  level  of  control  intervention 
required  to  achieve  an  acceptable  level  of  residual  risk 

Medium 

Acceptable  level  of  inherent  risk,  except  under  unique  circumstances  or 
conditions  -  Moderate  level  of  control  intervention  required  to  achieve 
an  acceptable  level  of  residual  risk 

4-6 

Low 

M  ostly  acceptable  level  of  inherent  risk  -  M  edium  level  of  control 
intervention  required 

1-3 

Minimum 

Acceptable  level  of  inherent  risk  -  Low  level  of  control  intervention 
required,  if  any 

Residual 

Risk  rating 

8-12 

Risk  magnitude 

Response 

High 

Unacceptable  level  of  residual  risk-  Implies  that  the  controlsare  either 
fundamentally  inadequate  (poor  design)  or  ineffective  (poor 
implementation).  Controls  require  substantial  redesign,  ora  greater 
emphasis  on  proper  implementation.  Acceptable  if  sufficient  controlsare 
implemented  which  are  regularly  monitored.  (5x3=15) 

Medium 

Acceptable  level  of  residual  risk,  within  risk  appetite  -  However  can  imply 
that  the  controls  can  be  improved  (poor  design)  or  ineffective  (poor 
implementation  or  non-adherence).  Controls  require  some  redesign,  or  a 
more  emphasis  on  proper  implementation  and  adherence. 

4-6 

Low 

Mostly  acceptable  level  of  residual  risk  -  Requires  minimal  control 
improvements. 

1-3 

Minimum 

Acceptable  level  of  residual  risk  -  Adequate  controls  implemented  and 
adhered  to. 

4 


